Home

Description

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

PUBLISHED Reserved 2024-10-09 | Published 2024-10-09 | Updated 2025-11-03 | Assigner mozilla

CISA Known Exploited Vulnerability

Date added 2024-10-15 | Due date 2024-11-05

Known Ransomware Campaign(s)  

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

Use-after-free in Animation timeline

Product status

Any version before 131.0.2
affected

Any version before 128.3.1
affected

Any version before 115.16.1
affected

Any version before 131.0.1
affected

Any version before 128.3.1
affected

Any version before 115.16.0
affected

Credits

Damien Schaeffer from ESET

References

www.cisa.gov/...nerabilities-catalog?field_cve=CVE-2024-9680 government-resource

bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992

lists.debian.org/debian-lts-announce/2024/10/msg00005.html

lists.debian.org/debian-lts-announce/2024/10/msg00006.html

bugzilla.mozilla.org/show_bug.cgi?id=1923344

msrc.microsoft.com/...ide/en-US/vulnerability/CVE-2024-49039 (Windows sandbox escape detected with the in-the-wild exploit)

www.mozilla.org/security/advisories/mfsa2024-51/

www.mozilla.org/security/advisories/mfsa2024-52/

cve.org (CVE-2024-9680)

nvd.nist.gov (CVE-2024-9680)

Download JSON